CVE-2019-11552 Code injection in n/a
A lower-privileged user can execute arbitrary code with higher privileges via a crafted proxy auto-configuration file in the Code42 Crashplan client.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11552?
CVE-2019-11552 is a high-severity code injection vulnerability in n/a, published on 19 Jul 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Code42 Enterprise and Crashplan for Small Business Client version 6.7 before 6.7.5, 6.8 before 6.8.8, and 6.9 before 6.9.4 allows eval injection. A proxy auto-configuration file, crafted by a lesser privileged user, may be used to execute arbitrary code at a higher privilege as the service user.
Weakness: CWE-94
Which versions are affected by CVE-2019-11552?
It affects 2 products.
Products include Code42 Code42 for Enterprise, Code42 Crashplan for Small Business.
How do I fix CVE-2019-11552?
No fix has been published for CVE-2019-11552 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-11552 being exploited?
There is no known exploitation of CVE-2019-11552 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jxg9-387c-h784.